Splunk Core Certified Power User — Question 79

When would transaction be used instead of stats?

Answer options

• A. To have a faster and more efficient search.
• B. To see results of a calculation.
• C. To group events based on start/end values.
• D. To group events based on a single field value.

Correct answer: C

Explanation

The correct answer is C because transactions are specifically designed to group events based on their start and end timestamps, allowing for a clear depiction of duration and relationships among events. Options A, B, and D do not accurately reflect the primary purpose of transactions, which is to manage event grouping rather than focusing on search speed or computation results.